A browser extension marketed for Twitch users sent account session tokens to a third-party service, putting people who installed it at risk of account misuse. Socket found that Twitch Enhanced Viewer | JeetBot, available in the Chrome Web Store and Firefox Add-ons store, intercepted Twitch authorization headers and forwarded OAuth tokens through JeetBot proxy servers, with current versions appending tokens as cleartext auth parameters in URLs that would be logged server-side. Earlier versions reportedly disclosed direct token transmission to the vendor’s server.
Why it matters: Affected users should remove the extension, log out of Twitch everywhere, and sign back in to invalidate exposed tokens. This matters because stolen session tokens can let a third party act on a user’s Twitch account without needing the user’s password.
Bill Toulas
2026.09.14
100% relevant
This article establishes a distinct new story about a specific Twitch-focused browser extension in official stores exposing OAuth tokens to JeetBot infrastructure.
← Back to all stories